A sophisticated threat campaign, referred to as “City-Forum,” is targeting publicly accessible Salesforce Experience Cloud sites and ServiceNow Service Portals, aiming to enumerate and extract data exposed to anonymous users.
Security firm Reco, which identified this activity, notes that the operator is using a custom multi-platform toolset instead of relying solely on widely available offensive tools.
This campaign is particularly noteworthy for combining well-known Salesforce Aura enumeration techniques with lesser-known methods against Salesforce Lightning Web Runtime (LWR) sites and the search infrastructure of ServiceNow portals.
The campaign has been traced back to the IP address 158.220.87.79, which is hosted by Contabo and is assigned to ASN 51167. The IP resolves to city-forum.com and several related subdomains, which is how the operation got its name.
Passive DNS evidence indicates that the infrastructure has been connected to this address since at least March 2025, suggesting the operator has maintained a long-term scanning environment.
Requests from the server consistently use the Go-http-client/1.1 user agent, which is the default for Go’s HTTP library. This indicates the activity is automated, coming from a compiled tool rather than typical browser traffic.
Reco observed that the same infrastructure targeted organizations across various sectors, including telecommunications, banking, financial services, enterprise software, security, privacy, and the public sector.
So far, the activity has been linked to guest or unauthenticated access. However, authenticated abuse cannot be entirely ruled out.
The central issue isn’t a newly disclosed platform vulnerability; rather, attackers are exploiting records, metadata, portal search results, and application functions that organizations have inadvertently made available to internet-facing guest users.
In traditional Salesforce Experience Cloud implementations, City-Forum utilizes the Aura framework’s /aura endpoint to enumerate accessible objects and records.
The attackers reportedly issue high volumes of requests invoking methods such as HostConfigController.getConfigData and SelectableListDataProviderController.getItems.
These calls can expose the types of objects accessible to the guest context, allowing systematic paging through records where sharing rules, object permissions, and field-level controls are overly permissive.
Reco recorded more than 560,000 events from a single IP address against a heavily targeted environment.
The operation also targets newer Salesforce LWR sites via the UI-API, including GraphQL endpoints at/webruntime/api/services/data/vNN.0/graphql.
A distinguishing feature is the sequential probing of API versions, reportedly ranging from v56.0 to v66.0. Attackers can use GraphQL queries to identify queryable objects and retrieve records accessible to the guest user.
They also probe the /SiteRegister and /CommunitiesSelfReg paths across discovered community sites, likely to check whether self-registration can elevate an anonymous visitor to an externally authenticated user with broader access.
ServiceNow instances are targeted through the native Service Portal search endpoint, specifically POST /api/now/sp/search?sysparm_cancelable=true.
This endpoint is public by design and can return an HTTP 201 status for both authenticated and anonymous requests, making it difficult to assess exposure based solely on status codes.
The security boundary instead depends on the portal’s configured search sources, scripted search logic, access controls, and Knowledge Base user criteria.
Insecure configurations may allow guest users to search for knowledge articles or custom data sources that were intended for internal audiences.
Defenders should immediately investigate the source IP, the Go-http-client/1.1 user agent, Salesforce Aura activity, LWR UI-API requests, self-registration probes, and ServiceNow guest requests directed to /api/now/sp/search.
Salesforce administrators should tighten guest-user sharing rules, eliminate unnecessary object and field permissions, disable self-registration where possible, restrict file and member visibility, and disable LWR guest access to public APIs.
ServiceNow teams should review public portals, detach unnecessary search sources, require authenticated access where appropriate, validate scripted sources using gs.isLoggedIn() and GlideRecordSecure, and audit Knowledge Base read criteria for overly broad “Any User” access.
| Indicator Type | Value |
|---|---|
| IPv4 address | 158.220.87.79 |
| ASN | AS51167 |
| Reverse DNS | vmi2213719.contaboserver.net |
| Primary domain | city-forum.com |
| Subdomain | www.city-forum.com |
| Subdomain | server.city-forum.com |
| Subdomain | mail.city-forum.com |
| User-Agent | Go-http-client/1.1 |
| Salesforce Aura endpoint | /aura |
| Salesforce Aura endpoint | /s/sfsites/aura |
| Salesforce Aura action | SelectableListDataProviderController/ACTION$getItems |
| Salesforce Aura action | HostConfigController/ACTION$getConfigData |
| Salesforce LWR GraphQL pattern | /<subsite>/webruntime/api/services/data/vNN.0/graphql |
| Salesforce version-sweep pattern | v56.0 through v66.0 |
| Salesforce registration probe | /SiteRegister |
| Salesforce registration probe | /CommunitiesSelfReg |
| ServiceNow endpoint | POST /api/now/sp/search?sysparm_cancelable=true |
| ServiceNow log source | syslog_transaction |
| ServiceNow behavioral indicator | Abnormal guest search volume |
| SPF record indicator | v=spf1 mx a ptr ip4:158.220.87.79 a:server.city-forum.com a:mail.city-forum.com -all |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…